@catladder/cli 0.0.0-next-aea5d3ad → 0.0.0-next-2b60440e

package/dist/bundles/cli/index.js

@@ -357,219 +357,6 @@ exports.getProjectMongodbAllPodsSortedWithLabel = getProjectMongodbAllPodsSorted
 
 /***/ }),
 
-/***/ 58002:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.projectConfigSecrets = void 0;
-const pipeline_1 = __nccwpck_require__(60241);
-const common_tags_1 = __nccwpck_require__(63779);
-const lodash_es_1 = __nccwpck_require__(64284);
-const getProjectConfig_1 = __nccwpck_require__(50001);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
-const editAsFile_1 = __nccwpck_require__(82805);
-const github_1 = __nccwpck_require__(18036);
-const gitlab_1 = __nccwpck_require__(4508);
-const promise_1 = __nccwpck_require__(51762);
-/* for convenience, parse json objects. that makes it easier to edit secrets that are object */
-const resolveJson = (v) => Object.fromEntries(Object.entries(v).map(([componentName, envs]) => {
-    return [
-        componentName,
-        Object.fromEntries(Object.entries(envs).map(([env, secrets]) => [
-            env,
-            Object.fromEntries(Object.entries(secrets).map(([key, value]) => {
-                try {
-                    return [key, JSON.parse(value)];
-                }
-                catch (e) {
-                    return [key, value];
-                }
-            })),
-        ])),
-    ];
-}));
-const getSecretEnvVarKeysToConfigure = async (env, componentName) => {
-    const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-    return [
-        ...jobOnlyVars.build.secretEnvVarKeys,
-        ...jobOnlyVars.deploy.secretEnvVarKeys,
-        ...secretEnvVarKeys,
-    ]
-        .filter((k) => !k.hidden)
-        .map((k) => k.key);
-};
-const getEnvVarsToEdit = async (instance, env, componentName) => {
-    const secretEnvVarKeys = await getSecretEnvVarKeysToConfigure(env, componentName);
-    const normalEnvVars = await (0, getProjectConfig_1.getEnvVarsResolved)(instance, env, componentName);
-    const jobOnlyEnvVars = await (0, getProjectConfig_1.getJobOnlyEnvVarsResolved)(instance, env, componentName);
-    const allEnvVars = {
-        ...normalEnvVars,
-        ...jobOnlyEnvVars,
-    };
-    return Object.fromEntries(secretEnvVarKeys.map((key) => {
-        const value = allEnvVars[key];
-        // due to some quirky way to resolve these variables, unset variables have the $CL_ prefix, so we remove thouse here
-        const variableIsNotSet = value === "$" + (0, pipeline_1.getSecretVarName)(env, componentName, key);
-        return [key, variableIsNotSet ? "🚨 FILL ME" : value];
-    }));
-};
-const doItFor = async (instance, envAndComponents) => {
-    let valuesToEdit = Object.fromEntries(await Promise.all(Object.entries(envAndComponents).map(async ([componentName, envs]) => [
-        componentName,
-        Object.fromEntries(await Promise.all(envs.map(async (env) => [
-            env,
-            await getEnvVarsToEdit(instance, env, componentName),
-        ]))),
-    ])));
-    let hasErrors = true;
-    while (hasErrors) {
-        valuesToEdit = await (0, editAsFile_1.editAsFile)(resolveJson(valuesToEdit), (0, common_tags_1.stripIndents) `
-        Please fill in all secrets for: 
-
-        ${Object.entries(envAndComponents)
-            .map(([componentName, envs]) => `- ${componentName}: ${envs.join(", ")}`)
-            .join("\n")}
-
-        `);
-        // check for errors
-        hasErrors = false;
-        for (const [componentName, envs] of Object.entries(envAndComponents)) {
-            for (const env of envs) {
-                const usedKeys = valuesToEdit[componentName][env]
-                    ? Object.keys(valuesToEdit[componentName][env])
-                    : [];
-                // check whether newValues have the exact number of keys
-                const secretEnvVarKeys = await getSecretEnvVarKeysToConfigure(env, componentName);
-                const extranous = (0, lodash_es_1.difference)(usedKeys, secretEnvVarKeys);
-                const missing = (0, lodash_es_1.difference)(secretEnvVarKeys, usedKeys);
-                if (extranous.length > 0 || missing.length > 0) {
-                    instance.log("");
-                    instance.log(`😿 Oh no! There is something wrong with "${componentName}"`);
-                    instance.log("");
-                    if (extranous.length > 0) {
-                        instance.log("these secrets are not declared in the config");
-                        extranous.forEach((key) => instance.log(key));
-                        instance.log("");
-                    }
-                    if (missing.length > 0) {
-                        instance.log("these secrets have not been provided:");
-                        missing.forEach((key) => instance.log(key));
-                        instance.log("");
-                    }
-                    await (0, promise_1.delay)(1000);
-                    const shouldContinue = await instance.confirm("Try again? 🤔");
-                    if (!shouldContinue) {
-                        throw new Error("abort");
-                    }
-                    hasErrors = true;
-                }
-            }
-        }
-    }
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
-        throw new Error("no catladder config found");
-    }
-    instance.log("");
-    instance.log("writing all secrets to the vault, please wait...");
-    instance.log("");
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-        for (const env of envs) {
-            instance.log("writing " + env + ":" + componentName + "...\n");
-            await (await instance.getVaultManager()).writeSecrets(env, componentName, valuesToEdit[componentName][env]);
-            instance.log("");
-            instance.log("✅ " + env + ":" + componentName);
-            instance.log("--------------------------------\n");
-        }
-    }
-    await mirrorSecretsToCiBackends(instance, config, envAndComponents, valuesToEdit);
-    instance.log("done! 😻");
-    instance.log("");
-};
-/**
- * the vault is the source of truth; every enabled CI backend receives
- * a mirrored copy of the edited secrets (gitlab variables, github
- * secrets), so all CI systems stay in sync
- */
-const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, valuesToEdit) => {
-    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
-    // gitlab mirror (unless gitlab is the vault itself, then it is
-    // already written)
-    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
-        for (const [componentName, envs] of Object.entries(envAndComponents)) {
-            for (const env of envs) {
-                await (0, gitlab_1.upsertAllVariables)(instance, valuesToEdit[componentName][env], env, componentName);
-            }
-        }
-        instance.log("✅ mirrored to gitlab");
-    }
-    if (!enabled.includes("github")) {
-        return;
-    }
-    const kinds = new Map();
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-        for (const env of envs) {
-            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-            [
-                ...secretEnvVarKeys,
-                ...jobOnlyVars.build.secretEnvVarKeys,
-                ...jobOnlyVars.deploy.secretEnvVarKeys,
-            ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-        }
-    }
-    const secrets = Object.entries(envAndComponents).flatMap(([componentName, envs]) => envs.flatMap((env) => {
-        var _a;
-        return Object.entries((_a = valuesToEdit[componentName][env]) !== null && _a !== void 0 ? _a : {}).map(([key, value]) => {
-            var _a;
-            const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
-            return {
-                name,
-                value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
-                kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-            };
-        });
-    }));
-    if (secrets.length === 0) {
-        return;
-    }
-    if (!(await (0, github_1.isGhAuthenticated)())) {
-        instance.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
-    if (!repo) {
-        instance.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
-};
-const projectConfigSecrets = async (io, envComponent) => {
-    if (!envComponent) {
-        const allEnvAndcomponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-        await doItFor(io, allEnvAndcomponents);
-    }
-    else {
-        const { env, componentName } = (0, getProjectConfig_1.parseChoice)(envComponent);
-        // componentName can be null. in this case, iterate over all  components
-        if (!componentName) {
-            const components = await (0, getProjectConfig_1.getProjectComponents)();
-            await doItFor(io, Object.fromEntries(components.map((c) => [c, [env]])));
-        }
-        if (componentName) {
-            await doItFor(io, {
-                [componentName]: [env],
-            });
-        }
-    }
-};
-exports.projectConfigSecrets = projectConfigSecrets;
-//# sourceMappingURL=commandConfigSecrets.js.map
-
-/***/ }),
-
 /***/ 88089:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -2533,7 +2320,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(70243);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({ enumerable: true, get: function () { return commandKubeCurrentContext_1.commandKubeCurrentContext; } }));
@@ -2562,6 +2349,14 @@ var commandCloudSqlProxy_1 = __nccwpck_require__(10878);
 Object.defineProperty(exports, "commandCloudSqlProxy", ({ enumerable: true, get: function () { return commandCloudSqlProxy_1.commandCloudSqlProxy; } }));
 var commandConfigSecrets_1 = __nccwpck_require__(40876);
 Object.defineProperty(exports, "commandConfigSecrets", ({ enumerable: true, get: function () { return commandConfigSecrets_1.commandConfigSecrets; } }));
+var commandSecretsPull_1 = __nccwpck_require__(2835);
+Object.defineProperty(exports, "commandSecretsPull", ({ enumerable: true, get: function () { return commandSecretsPull_1.commandSecretsPull; } }));
+var commandSecretsPush_1 = __nccwpck_require__(1460);
+Object.defineProperty(exports, "commandSecretsPush", ({ enumerable: true, get: function () { return commandSecretsPush_1.commandSecretsPush; } }));
+var commandSecretsSet_1 = __nccwpck_require__(65514);
+Object.defineProperty(exports, "commandSecretsSet", ({ enumerable: true, get: function () { return commandSecretsSet_1.commandSecretsSet; } }));
+var commandSecretsList_1 = __nccwpck_require__(97240);
+Object.defineProperty(exports, "commandSecretsList", ({ enumerable: true, get: function () { return commandSecretsList_1.commandSecretsList; } }));
 var commandSecretsClearBackups_1 = __nccwpck_require__(49558);
 Object.defineProperty(exports, "commandSecretsClearBackups", ({ enumerable: true, get: function () { return commandSecretsClearBackups_1.commandSecretsClearBackups; } }));
 var commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
@@ -2977,34 +2772,75 @@ exports.commandCloudSqlProxy = (0, defineCommand_1.defineCommand)({
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.commandConfigSecrets = void 0;
+const common_tags_1 = __nccwpck_require__(63779);
 const defineCommand_1 = __nccwpck_require__(39489);
-const commandConfigSecrets_1 = __nccwpck_require__(58002);
-const autocompletions_1 = __nccwpck_require__(52468);
-// This command delegates to the existing implementation which uses
-// editAsFile (opens editor) and has retry loops with confirm prompts.
-// Full migration to CommandIO would require reworking the editor flow,
-// so for now we bridge it.
+const editAsFile_1 = __nccwpck_require__(82805);
+const promise_1 = __nccwpck_require__(51762);
+const document_1 = __nccwpck_require__(52283);
+const scope_1 = __nccwpck_require__(17712);
+const parseKeysInput_1 = __nccwpck_require__(55443);
 exports.commandConfigSecrets = (0, defineCommand_1.defineCommand)({
     name: "project config-secrets",
-    description: "setup/update secrets stored in pass",
+    description: "setup/update secrets in the vault via your editor",
     group: "project",
     inputs: {
         envComponent: {
             type: "string",
-            message: "environment:component",
+            message: "scope: env:component, env:, :component or empty for everything",
             positional: true,
             required: false,
-            choices: async () => (0, autocompletions_1.envAndComponents)(),
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only edit these secrets (comma-separated keys)",
+            required: false,
         },
     },
     execute: async (ctx) => {
         const envComponent = await ctx.get("envComponent");
-        // Bridge: the existing implementation accepts CommandInstance-like
-        // objects for logging and prompting. Since it uses this.prompt()
-        // internally (not ctx.prompt), we pass ctx which satisfies the
-        // IO interface for logging. The interactive prompts inside
-        // projectConfigSecrets will need a deeper migration later.
-        await (0, commandConfigSecrets_1.projectConfigSecrets)(ctx, envComponent);
+        const keys = (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key"));
+        if (!ctx.interactive) {
+            throw new Error("project config-secrets opens an editor and needs an interactive terminal — " +
+                "use `project secrets-pull`, `project secrets-push` or `project secrets-set` instead");
+        }
+        const scope = await (0, scope_1.resolveSecretsScope)(envComponent);
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, keys);
+        let document = await (0, document_1.buildSecretsDocument)(ctx, scoped);
+        let hasErrors = true;
+        while (hasErrors) {
+            document = await (0, editAsFile_1.editAsFile)(document, (0, common_tags_1.stripIndents) `
+        Please fill in all secrets for:
+
+        ${(0, scope_1.formatScope)(scoped)}
+
+        `);
+            const problems = (0, document_1.checkSecretsDocument)(document, scoped, {
+                requireComplete: true,
+            });
+            hasErrors = problems.length > 0;
+            if (hasErrors) {
+                ctx.log("");
+                ctx.log("😿 Oh no! There is something wrong:");
+                ctx.log("");
+                problems.forEach((problem) => ctx.log(problem));
+                ctx.log("");
+                await (0, promise_1.delay)(1000);
+                const shouldContinue = await ctx.confirm("Try again? 🤔");
+                if (!shouldContinue) {
+                    throw new Error("abort");
+                }
+            }
+        }
+        const { writes, skipped } = (0, document_1.collectSecretsWrites)(document, scoped);
+        if (skipped.length > 0) {
+            ctx.log("");
+            ctx.log("⏭️ these secrets are still unset and will not be written:");
+            skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+        }
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+        ctx.log("");
     },
 });
 //# sourceMappingURL=commandConfigSecrets.js.map
@@ -4248,6 +4084,626 @@ exports.commandTriggerCronjobProject = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 97240:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandSecretsList = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const defineCommand_1 = __nccwpck_require__(39489);
+const scope_1 = __nccwpck_require__(17712);
+const parseKeysInput_1 = __nccwpck_require__(55443);
+exports.commandSecretsList = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-list",
+    description: "lists the declared secrets of a scope with their set/unset status (values only with --reveal)",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only these secrets (comma-separated keys)",
+            required: false,
+        },
+        reveal: {
+            type: "boolean",
+            message: "also print the secret values",
+            default: false,
+        },
+        check: {
+            type: "boolean",
+            message: "exit with an error when any secret is unset (for CI/agents)",
+            default: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const reveal = await ctx.get("reveal");
+        const names = scoped.flatMap(({ env, componentName, keys }) => keys.map((key) => (0, pipeline_1.getSecretVarName)(env, componentName, key)));
+        const values = await (await ctx.getVaultManager()).readSecrets(names, ctx);
+        let unsetCount = 0;
+        let setCount = 0;
+        for (const { env, componentName, keys } of scoped) {
+            for (const key of keys) {
+                const value = values[(0, pipeline_1.getSecretVarName)(env, componentName, key)];
+                if (value === undefined) {
+                    unsetCount += 1;
+                    ctx.log(`🚨 ${env}:${componentName} ${key} (unset)`);
+                }
+                else {
+                    setCount += 1;
+                    ctx.log(`✅ ${env}:${componentName} ${key}` + (reveal ? ` = ${value}` : ""));
+                }
+            }
+        }
+        ctx.log("");
+        ctx.log(`${setCount} set, ${unsetCount} unset`);
+        if ((await ctx.get("check")) && unsetCount > 0) {
+            throw new Error(`${unsetCount} secrets are unset`);
+        }
+    },
+});
+//# sourceMappingURL=commandSecretsList.js.map
+
+/***/ }),
+
+/***/ 2835:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandSecretsPull = void 0;
+const fs_extra_1 = __nccwpck_require__(96954);
+const yaml_1 = __nccwpck_require__(6637);
+const defineCommand_1 = __nccwpck_require__(39489);
+const document_1 = __nccwpck_require__(52283);
+const scope_1 = __nccwpck_require__(17712);
+const parseKeysInput_1 = __nccwpck_require__(55443);
+exports.commandSecretsPull = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-pull",
+    description: "prints the current secrets of a scope as yaml (unset ones as a placeholder) — edit and feed to secrets-push",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only these secrets (comma-separated keys)",
+            required: false,
+        },
+        out: {
+            type: "string",
+            message: "write the yaml to this file instead of stdout",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const document = await (0, document_1.buildSecretsDocument)(ctx, scoped);
+        const yaml = (0, yaml_1.stringify)(document, { aliasDuplicateObjects: false });
+        const out = await ctx.get("out");
+        if (out) {
+            await (0, fs_extra_1.writeFile)(out, yaml);
+            ctx.log(`wrote secrets to ${out} — ⚠️ contains secret values, don't commit it`);
+        }
+        else {
+            ctx.log(yaml);
+        }
+    },
+});
+//# sourceMappingURL=commandSecretsPull.js.map
+
+/***/ }),
+
+/***/ 1460:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandSecretsPush = void 0;
+const fs_extra_1 = __nccwpck_require__(96954);
+const yaml_1 = __nccwpck_require__(6637);
+const defineCommand_1 = __nccwpck_require__(39489);
+const readStdin_1 = __nccwpck_require__(185);
+const document_1 = __nccwpck_require__(52283);
+const scope_1 = __nccwpck_require__(17712);
+const parseKeysInput_1 = __nccwpck_require__(55443);
+exports.commandSecretsPush = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-push",
+    description: "writes secrets from a yaml document (secrets-pull format, --file or stdin) to the vault; may be partial",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only write these secrets (comma-separated keys)",
+            required: false,
+        },
+        file: {
+            type: "string",
+            message: "yaml file to push (component → env → key: value); stdin when omitted",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const file = await ctx.get("file");
+        if (!file && process.stdin.isTTY) {
+            throw new Error("nothing to push — pass --file <secrets.yml> or pipe yaml (secrets-pull format) to stdin");
+        }
+        const raw = file
+            ? (await (0, fs_extra_1.readFile)(file)).toString("utf-8")
+            : await (0, readStdin_1.readStdin)();
+        const document = (0, yaml_1.parse)(raw);
+        if (!document || typeof document !== "object") {
+            throw new Error("the document must be a yaml object: component → env → key: value (see secrets-pull)");
+        }
+        const problems = (0, document_1.checkSecretsDocument)(document, scoped, {
+            requireComplete: false,
+        });
+        if (problems.length > 0) {
+            throw new Error("😿 the document does not match the config:\n" +
+                problems.map((problem) => `  - ${problem}`).join("\n"));
+        }
+        const { writes, skipped } = (0, document_1.collectSecretsWrites)(document, scoped);
+        if (skipped.length > 0) {
+            ctx.log("⏭️ skipping placeholder/empty values:");
+            skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+        }
+        if (writes.length === 0) {
+            ctx.log("no secrets to write 🤷");
+            return;
+        }
+        ctx.log("about to write:");
+        writes.forEach(({ env, componentName, secrets }) => ctx.log(`  - ${env}:${componentName}: ${Object.keys(secrets).join(", ")}`));
+        const confirmed = await ctx.confirm("continue? 🤔");
+        if (!confirmed) {
+            throw new Error("abort");
+        }
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+    },
+});
+//# sourceMappingURL=commandSecretsPush.js.map
+
+/***/ }),
+
+/***/ 65514:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandSecretsSet = void 0;
+const fs_extra_1 = __nccwpck_require__(96954);
+const defineCommand_1 = __nccwpck_require__(39489);
+const readStdin_1 = __nccwpck_require__(185);
+const document_1 = __nccwpck_require__(52283);
+const scope_1 = __nccwpck_require__(17712);
+const resolveValue = async (io, value, valueFile) => {
+    if (valueFile) {
+        // a trailing newline is almost never part of the secret
+        return (await (0, fs_extra_1.readFile)(valueFile)).toString("utf-8").replace(/\n$/, "");
+    }
+    if (value !== undefined) {
+        return value;
+    }
+    if (!process.stdin.isTTY) {
+        return (await (0, readStdin_1.readStdin)()).replace(/\n$/, "");
+    }
+    return io.promptDirect({
+        name: "value",
+        type: "string",
+        message: "value",
+    });
+};
+exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-set",
+    description: "sets one secret — in one env (dev:web), one env everywhere (dev:), or all envs of a component (:web); value via --value, --value-file or stdin",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, or :component",
+            positional: true,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "which secret?",
+            positional: true,
+            choices: async (ctx) => {
+                const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+                const scoped = await (0, scope_1.getScopedSecretKeys)(scope);
+                return [...new Set(scoped.flatMap(({ keys }) => keys))];
+            },
+        },
+        value: {
+            type: "string",
+            message: "the secret value (prefer --value-file or stdin over shell history)",
+            required: false,
+        },
+        valueFile: {
+            type: "string",
+            message: "read the secret value from this file",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const key = await ctx.get("key");
+        // drops env/component pairs where the key is not declared and
+        // throws when it is declared nowhere in the scope
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, [key]);
+        const value = await resolveValue(ctx, await ctx.get("value"), await ctx.get("valueFile"));
+        const targets = scoped.map(({ env, componentName }) => `${env}:${componentName}`);
+        ctx.log(`setting ${key} in: ${targets.join(", ")}`);
+        if (targets.length > 1) {
+            const confirmed = await ctx.confirm(`write the same value to ${targets.length} environments? 🤔`);
+            if (!confirmed) {
+                throw new Error("abort");
+            }
+        }
+        const writes = scoped.map(({ env, componentName }) => ({
+            env,
+            componentName,
+            secrets: { [key]: value },
+        }));
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+    },
+});
+//# sourceMappingURL=commandSecretsSet.js.map
+
+/***/ }),
+
+/***/ 52283:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.writeSecretsAndMirror = exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const github_1 = __nccwpck_require__(18036);
+const gitlab_1 = __nccwpck_require__(4508);
+const commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
+/** placeholder for secrets that have no value in the vault yet */
+exports.FILL_ME = "🚨 FILL ME";
+/* for convenience, parse json values. that makes it easier to edit secrets that are objects */
+const parseJsonValue = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch (e) {
+        return value;
+    }
+};
+/**
+ * builds the document for the given scope with the current values from
+ * the vault; unset secrets appear as the FILL_ME placeholder
+ */
+const buildSecretsDocument = async (io, scoped) => {
+    var _a;
+    const names = scoped.flatMap(({ env, componentName, keys }) => keys.map((key) => (0, pipeline_1.getSecretVarName)(env, componentName, key)));
+    const values = await (await io.getVaultManager()).readSecrets(names, io);
+    const document = {};
+    for (const { env, componentName, keys } of scoped) {
+        (_a = document[componentName]) !== null && _a !== void 0 ? _a : (document[componentName] = {});
+        document[componentName][env] = Object.fromEntries(keys.map((key) => {
+            const value = values[(0, pipeline_1.getSecretVarName)(env, componentName, key)];
+            return [key, value === undefined ? exports.FILL_ME : parseJsonValue(value)];
+        }));
+    }
+    return document;
+};
+exports.buildSecretsDocument = buildSecretsDocument;
+/**
+ * validates a document against the scope. Undeclared components, envs
+ * or keys are always problems; missing keys only when `requireComplete`
+ * (the guided editor flow) — pushes may be partial.
+ */
+const checkSecretsDocument = (document, scoped, { requireComplete }) => {
+    var _a, _b;
+    const problems = [];
+    const scopedKeys = new Map();
+    scoped.forEach(({ env, componentName, keys }) => scopedKeys.set(`${env}:${componentName}`, keys));
+    const scopedComponents = new Set(scoped.map((s) => s.componentName));
+    for (const [componentName, envs] of Object.entries(document !== null && document !== void 0 ? document : {})) {
+        if (!scopedComponents.has(componentName)) {
+            problems.push(`"${componentName}" is not a component in this scope — remove it or widen the scope`);
+            continue;
+        }
+        for (const [env, secrets] of Object.entries(envs !== null && envs !== void 0 ? envs : {})) {
+            const keys = scopedKeys.get(`${env}:${componentName}`);
+            if (!keys) {
+                problems.push(`"${env}:${componentName}" is not in this scope — remove it or widen the scope`);
+                continue;
+            }
+            const extraneous = Object.keys(secrets !== null && secrets !== void 0 ? secrets : {}).filter((key) => !keys.includes(key));
+            extraneous.forEach((key) => problems.push(`"${env}:${componentName}": "${key}" is not declared in the config (or filtered out by --key)`));
+        }
+    }
+    if (requireComplete) {
+        for (const { env, componentName, keys } of scoped) {
+            const provided = Object.keys((_b = (_a = document === null || document === void 0 ? void 0 : document[componentName]) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {});
+            keys
+                .filter((key) => !provided.includes(key))
+                .forEach((key) => problems.push(`"${env}:${componentName}": "${key}" has not been provided`));
+        }
+    }
+    return problems;
+};
+exports.checkSecretsDocument = checkSecretsDocument;
+/**
+ * turns a (validated) document into writes. FILL_ME placeholders and
+ * empty (null) values are skipped, so an untouched placeholder can
+ * never end up as a live secret value.
+ */
+const collectSecretsWrites = (document, scoped) => {
+    var _a, _b;
+    const writes = [];
+    const skipped = [];
+    for (const { env, componentName, keys } of scoped) {
+        const provided = (_b = (_a = document === null || document === void 0 ? void 0 : document[componentName]) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {};
+        const secrets = {};
+        for (const key of keys) {
+            if (!(key in provided)) {
+                continue;
+            }
+            const value = provided[key];
+            if (value === exports.FILL_ME || value === null || value === undefined) {
+                skipped.push(`${env}:${componentName} ${key}`);
+                continue;
+            }
+            secrets[key] = value;
+        }
+        if (Object.keys(secrets).length > 0) {
+            writes.push({ env, componentName, secrets });
+        }
+    }
+    return { writes, skipped };
+};
+exports.collectSecretsWrites = collectSecretsWrites;
+/**
+ * writes secrets to the vault (the source of truth) and mirrors them
+ * to every enabled CI backend — which backends exist is invisible to
+ * the caller
+ */
+const writeSecretsAndMirror = async (io, writes) => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    io.log("");
+    io.log("writing secrets to the vault, please wait...");
+    io.log("");
+    for (const { env, componentName, secrets } of writes) {
+        io.log("writing " + env + ":" + componentName + "...\n");
+        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets);
+        io.log("");
+        io.log("✅ " + env + ":" + componentName);
+        io.log("--------------------------------\n");
+    }
+    await mirrorSecretsToCiBackends(io, config, writes);
+};
+exports.writeSecretsAndMirror = writeSecretsAndMirror;
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the written secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (io, config, writes) => {
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    // gitlab mirror (unless gitlab is the vault itself, then it is
+    // already written)
+    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+        for (const { env, componentName, secrets } of writes) {
+            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+        }
+        io.log("✅ mirrored to gitlab");
+    }
+    if (!enabled.includes("github")) {
+        return;
+    }
+    const kinds = new Map();
+    for (const { env, componentName } of writes) {
+        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+        [
+            ...secretEnvVarKeys,
+            ...jobOnlyVars.build.secretEnvVarKeys,
+            ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
+        var _a;
+        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+        return {
+            name,
+            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        };
+    }));
+    if (secrets.length === 0) {
+        return;
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    if (!repo) {
+        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(io, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
+};
+//# sourceMappingURL=document.js.map
+
+/***/ }),
+
+/***/ 55443:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parseKeysInput = void 0;
+/** parses a comma-separated `--key` input into a list of keys */
+const parseKeysInput = (input) => {
+    const keys = input === null || input === void 0 ? void 0 : input.split(",").map((key) => key.trim()).filter(Boolean);
+    return keys && keys.length > 0 ? keys : undefined;
+};
+exports.parseKeysInput = parseKeysInput;
+//# sourceMappingURL=parseKeysInput.js.map
+
+/***/ }),
+
+/***/ 17712:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.formatScope = exports.getScopedSecretKeys = exports.getDeclaredSecretKeys = exports.secretsScopeChoices = exports.resolveSecretsScope = void 0;
+const getProjectConfig_1 = __nccwpck_require__(50001);
+/**
+ * resolves a scope expression to component → envs:
+ * - (empty): all components, all envs
+ * - `env:component`: one env of one component
+ * - `env` / `env:`: one env, every component that has it
+ * - `:component`: every env of one component
+ */
+const resolveSecretsScope = async (scope) => {
+    const all = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    if (Object.keys(all).length === 0) {
+        throw new Error("no catladder config found");
+    }
+    if (!scope) {
+        return all;
+    }
+    const [env, componentName] = scope.split(":").map((x) => x || null);
+    if (componentName && !(componentName in all)) {
+        throw new Error(`unknown component "${componentName}" — components: ${Object.keys(all).join(", ")}`);
+    }
+    const scoped = Object.fromEntries(Object.entries(all)
+        .filter(([name]) => !componentName || name === componentName)
+        .map(([name, envs]) => [
+        name,
+        env ? envs.filter((e) => e === env) : envs,
+    ])
+        .filter(([, envs]) => envs.length > 0));
+    if (Object.keys(scoped).length === 0) {
+        const allEnvs = [...new Set(Object.values(all).flat())];
+        throw new Error(`no component has the environment "${env}" — environments: ${allEnvs.join(", ")}`);
+    }
+    return scoped;
+};
+exports.resolveSecretsScope = resolveSecretsScope;
+/**
+ * all valid scope expressions, for autocompletion: `env:component`
+ * pairs plus the `env:` (one env, all components) and `:component`
+ * (one component, all envs) forms
+ */
+const secretsScopeChoices = async () => {
+    const all = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    const pairs = Object.entries(all).flatMap(([componentName, envs]) => envs.map((env) => `${env}:${componentName}`));
+    const envs = [...new Set(Object.values(all).flat())];
+    return [
+        ...pairs,
+        ...envs.map((env) => `${env}:`),
+        ...Object.keys(all).map((componentName) => `:${componentName}`),
+    ];
+};
+exports.secretsScopeChoices = secretsScopeChoices;
+/** the secret keys declared in the config for one env of one component */
+const getDeclaredSecretKeys = async (env, componentName) => {
+    const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+    return [
+        ...jobOnlyVars.build.secretEnvVarKeys,
+        ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ...secretEnvVarKeys,
+    ]
+        .filter((k) => !k.hidden)
+        .map((k) => k.key);
+};
+exports.getDeclaredSecretKeys = getDeclaredSecretKeys;
+/**
+ * expands a scope to its declared secret keys, optionally filtered to
+ * `onlyKeys`. Throws when a requested key is not declared anywhere in
+ * the scope (typo protection); env/component pairs without matching
+ * keys are dropped.
+ */
+const getScopedSecretKeys = async (scope, onlyKeys) => {
+    const scoped = [];
+    const declaredAnywhere = new Set();
+    for (const [componentName, envs] of Object.entries(scope)) {
+        for (const env of envs) {
+            const declared = await (0, exports.getDeclaredSecretKeys)(env, componentName);
+            declared.forEach((key) => declaredAnywhere.add(key));
+            const keys = onlyKeys
+                ? declared.filter((key) => onlyKeys.includes(key))
+                : declared;
+            if (keys.length > 0) {
+                scoped.push({ env, componentName, keys });
+            }
+        }
+    }
+    const unknownKeys = (onlyKeys !== null && onlyKeys !== void 0 ? onlyKeys : []).filter((key) => !declaredAnywhere.has(key));
+    if (unknownKeys.length > 0) {
+        throw new Error(`these secrets are not declared in this scope: ${unknownKeys.join(", ")}` +
+            `\ndeclared secrets: ${[...declaredAnywhere].join(", ")}`);
+    }
+    if (scoped.length === 0) {
+        throw new Error("there are no secrets to configure in this scope");
+    }
+    return scoped;
+};
+exports.getScopedSecretKeys = getScopedSecretKeys;
+/** human-readable one-line-per-component summary of a scope */
+const formatScope = (scoped) => {
+    var _a;
+    const byComponent = new Map();
+    for (const { env, componentName } of scoped) {
+        byComponent.set(componentName, [
+            ...((_a = byComponent.get(componentName)) !== null && _a !== void 0 ? _a : []),
+            env,
+        ]);
+    }
+    return [...byComponent.entries()]
+        .map(([componentName, envs]) => `- ${componentName}: ${envs.join(", ")}`)
+        .join("\n");
+};
+exports.formatScope = formatScope;
+//# sourceMappingURL=scope.js.map
+
+/***/ }),
+
 /***/ 45498:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -6515,6 +6971,26 @@ exports.delay = delay;
 
 /***/ }),
 
+/***/ 185:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readStdin = void 0;
+/** reads the whole stdin stream (for piped input in non-interactive use) */
+const readStdin = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf-8");
+};
+exports.readStdin = readStdin;
+//# sourceMappingURL=readStdin.js.map
+
+/***/ }),
+
 /***/ 45381:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {